typofinder

Domain typo finder Typofinder for domain typo discovery Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by: Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com Stephen Tomkinson, @neonbunny9 on twitter Matt Summers, matt dot summers at nccgroup dot com...

uriDeep

uriDeep Unicode encoding attacks with machine learning. Tool based on machine learning to create amazing fake domains using confusables. Some domains can deceive IDN policies Chrome & Firefox. I created the best big dictionary of confusables using neural networks. It is used in the tool and it ca...

CVE-2021-42694

CVE-2021-42694 Generate malicious files using recently published homoglyph-attack vulnerability, which was discovered at least in C, C++, C, Go, Python, Rust, JS, ... Cite from cve.mitre.org An issue was discovered in the character definitions of the Unicode Specification through 14.0. The...

CVE-2021-42694

CVE-2021-42694 This script implements a Homoglyph detection tool, primarily used to detect potential CVE-2021-42694 vulnerabilities in code. Let me explain its main functions in detail: Core Features: Detect homoglyph substitution attacks in code Scan identifiers such as variable names and functi...

ditto

Ditto es una pequeña herramienta que acepta un nombre de dominio como entrada y genera todas sus variantes para un ataque homográfico como salida, verificando cuáles están disponibles y cuáles ya están registrados. Dominios PoC https://tᴡitter.com/ https://clᴏudflare.com Usando con Docker La imag...

homoglyphs

THE PROJECT IS ARCHIVED Forks: https://github.com/orsinium/forks Homoglyphs Homoglyphs -- python library for getting homoglyphs and converting to ASCII. Features It's smarter version of confusablehomoglyphs: Autodect or manual choosing category aliases from ISO 15924. Auto or manual load only...

huntglyph

huntglyph — Detect homograph attacks Homograph attacks leverage the visual similarity of characters from different writing systems e.g., Latin 'a' vs. Cyrillic 'а' to spoof domain names, filenames, or other identifiers, tricking users into believing they are interacting with a legitimate source...

DeBERTa-ConPara: Attack-Aware and Deployment-Realistic Detection of AI-Generated Text

Robust detection of AI-generated text under deployment conditions is challenging: distribution shifts across domains and generators, adversarial perturbations of the input surface, and the absence of target-domain labels for threshold calibration all degrade detectors that perform well in-domain...

CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

CVE-2026-73420

CVE-2026-73420 affects NextAuth.js email/passwordless flows where the default email normalizer validates addresses before Unicode normalization. An address containing a homoglyph (e.g., U+FF20 FULLWIDTH COMMERCIAL AT) can canonicalize to a normal ASCII @ after NFKC/NFKD, causing downstream mail l...

CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

Incomplete List of Disallowed Inputs

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the validatePythonCodeForDataFrame process. An attacker can execute arbitrary operating system commands by submitting specially crafted Python code...

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...

GHSA-52FH-8V99-63C2 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...

CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

CVE-2026-70470

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...